Powershell Script to reset Windows 2016+ Remote Desktop Host firewall

This a quick script to reset a Windows Servers firewall and insert the fix for cleaning down the rules when user logs off on a Remote Desktop Host.

#Powershell

Remove-Item "HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System"
New-Item "HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System"
Remove-Item "HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso\FirewallRules"
New-Item "HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso\FirewallRules"
(New-Object -ComObject HNetCfg.FwPolicy2).RestoreLocalFirewallDefaults()
New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy' -Name  'DeleteUserAppContainersOnLogoff' -Value '1' -PropertyType 'DWORD' –Force

#EOF

Enable Windows Photo Viewer within Windows 10, 2016, and 2019

Here is the Reg keys to enabled the Windows Photo Viewer that is still part of Windows 10, 2016, and 2019.

This is works well for 2019 Remote Desktop Host

https://gist.github.com/AndyUK24601/cc26266e7af84df3297d7d63271c18fc

Before doing this I would make sure that the following below location still exists as Microsoft may remove it later down the line

"C:\Program Files (x86)\Windows Photo Viewer"

You will also need to run the following too in cmd as admin

regsvr32 "C:\Program Files (x86)\Windows Photo Viewer\PhotoViewer.dll"

Side note,  running the REG does make it the default straight away

Windows 2019 Remote Desktop Start menu stops working

 This one has driven me crazy over the last year or so as different things appear to break it and different fixes appear to resolve it.

• Windows server has missed a few updates
  
• Every fix should start with updating, unless an update broke the system then skip this part
  
  
• Windows Firewall as too many rules
• Each time user logs in to the server a few rules are added to the firewall but over time this can lead to thousands of rules being made,  this was fixed in Windows 2016 but it appears that 2019 needs a reg key enabling to sort it.
  
  Also you will need to clean out all the old rules,  quickest way is too open the "Windows Defender Firewall with Advanced Security", right click on "Windows Defender Firewall with Advanced Security on Local Computer" and select Restore default policy
  
  This will reset the polices but you had an custom polices these will not be gone and need to be remade.  still quicker then trying to delete bad ones with the system locking up all the time.
  
  Only Forward: Remote Desktop Host firewall is filled with multiple firewall rules (only-forward.net)
  
  
• Firewall Reg Keys that need removing and remaking
  
• Open Powershell as admin
• Type the Following:
  
  • Remove-Item "HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System"
  • New-Item "HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System"
  • Remove-Item "HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso\FirewallRules"
  • New-Item "HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso\FirewallRules"
• Corruption in the Universal Windows Platform applications
• I think its the explorer app that gets damaged but am not 100% on that.
  
  run the following in an PowerShell(admin) console
  
  1. sfc /scannow
  2. dism /online /cleanup-image /scanhealth
  3. dism /online /cleanup-image /restorehealth
  
  Now if point 3 ends with an error like it can not find the source to resolve the issue,  you can use a donor system to pull the files from but its got to be working and updated to the same level (ish,  I have had success with a outdated 2019 as a donor to an updated 2019 but mileage may vary here it could break more then it fixes)
  
  4. Dism /Online /Cleanup-Image /RestoreHealth /source:\\<DEVICE>\C$\Windows\WinSxS /limitaccess
  5. Get-AppXPackage -AllUsers | Foreach {Add-AppxPackage -DisableDevelopmentMode -Register "$($_.InstallLocation)\AppXManifest.xml"}
  
  Now point 3 and 4 can be swapped with using the install media if you have it available but I have never tested it this way as I have never had it to hand but the command is
  
  Dism /Online /Cleanup-Image /RestoreHealth /source:wim:D:\\sources\install.wim:1 /limitaccess
  (on the install.wim:1 the :1 is the version of the OS you are using, like core / Desktop / Data Center / Standard)

Remote Desktop Host firewall is filled with multiple firewall rules

Every time a user connects in to the RDH,  firewall rules are made for the users Windows Apps but never cleaned down.

This can have a few issues linked to it like Black screening on the host or the start menu not displaying but depending on the Windows version you mileage will vary.  In all case it can lead to slowing down of the system.

For Windows Server 2016 you will need to confirm the following update is installed KB4467684,  Server 2019 should already be able to do this but I would bring it in line with all updates to just be sure.

Make a GPO if you have more then 2 RDH and put this Key in place.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy
DeleteUserAppContainersOnLogoff (DWORD)
Value: 1

No Microsoft document appears to back this up but it is listed in a few updates and talked about as a known issue under KB4467684

Windows server 2019 Remote Desktop Host with Search installed

 The way Windows 2019 / Windows 10 works with search has changed.  the short of it is that now parts are stored in the user profile which can have issues with User Profile Disks.

If you are seeing the follow event in the event log

Event Log: Application

Event Level: Error

Event Source: Search-ProfileNotify

Event ID: 2

Event Data: Unable to remove Windows Search Service indexed data for user '<User Name>’ in response to user profile deletion.  Error code 0x80004002

This can be the start of issues with Search for all users.  The fix is to make a task that triggers on this event to restart the search service.

Program: powershell.exe
Arguments: restart-service WSearch

This was taken from jkindon.com site so that I have it at hand if it comes back up again, but they go in to more details of the thing.

Windows Search in Server 2019 and Multi-Session Windows 10 – James Kindon (jkindon.com)

Search Service Tuning on a Remote Desktop Services (RDS) Server GPO Settings

 Recommended GPO Settings

These GPO settings can be updated to turn down the indexing while allowing the Outlook’s instant search feature to function.

• Windows Components/Search
• Allow indexing of encrypted files, Disabled
• Prevent adding UNC locations to index from Control Panel, Enabled
• Prevent adding user-specified locations to the All Locations menu, Enabled
• Prevent automatically adding shared folders to the index, Enabled
• Prevent indexing e-mail attachments, Enabled
• Prevent indexing of certain file types, Enabled
• Prevent indexing public folders, Enabled
• Enable Throttling for online mail indexing, 6 items per minute (maximum is 120 per minute)
• Prevent indexing certain paths:
  file:///C:\*
  outlookexpress://{*}/*
  otfs://{*}/*
  mapi://{*}/*
  mapi15://{*}/*
  ONEINDEX15://{*}/*
  iehistory://{*}/

Copied for Keep sake from

Search Service Tuning on a Remote Desktop Services (RDS) Server - Peters & Associates

Windows Hyper-V 2019 failed merge of snapshot with error 0x8007054F

 This is not a good fix and am not happy with it... seems a little too much like the nuclear option but it works and at the moment Microsoft are not being to forthcoming with answers and we seem to be stuck between the backup company and them pointing the fingers at each other,

I will update if we get a better fix.

But for now if you are seeing phantom snapshots where if you restart the Hyper V machine management server it will try to merge then fail with the following error code

0x8007054F

The issue appears to be the root parent, not being able to merge with the last checkpoint.  so you could roll all the AVHDX files back to the first one and that last one will not merge back with the primary disk.

Update #1 (02/12/2020)
After manually merge a few servers it is clear the issue is only with the System drive / First drive in the VM config.

Not sure if it because its the system drive or its the first one in the list in the VM config, but removing it from the VM config allows it too start merging the other drives as soon as the config is save.  this has allowed us to save a lot of time and cut down the work we need to do in the sort time.

Update #2 (07/12/2020)
Seems update 1 was false.  Although all up to that date had been the system drive / first one in the VM config the last two I cleaned up was data drives.  both at the end of the VM config list.

Still waiting on an update from Microsoft on this.

Update #3 (14/01/2021)
Microsoft are asking for the VM to be deleted and remade so that it makes a new VM ID,  we are testing this and will update if this has an impact.

Update #4 (09/02/2021)
The VM we have remade have not had issue with check pointing but the others have not either so its still up in the air at the moment.

Update #5 (10/03/2021)
Confirmation this week that the issue has returned on guests where we have not remade the VM config but the ones we have are still running fine and merging back even on the same host.

Short term fix
The quickest way I have found so far to resolve this is to do the Following

1. Shutdown the virtual machine
2. Break and remove replication if its enabled
3. Open the virtual machines settings
4. Take a note of the disk and location of the VM has set,  should end in a AVHDX
5. Remove the disk
6. Open Hyper-V and select "Edit Disk" point it to the AVHDX you noted in point 4 and select "Merge"
7. Once on the Merge options select new disk and give it a name and a location
8. Attach this new disk to the virtual machine in the same controller as the one you removed
9. Boot the VM and confirm its working
10. Remove old VHDX and AVHDX files
11. Enable replication if you disabled it.

Doing it this way can be risky so always check your backups but it does work.

Using 3rd party antivirus on Windows server 2016 and 2019

If you using a 3rd party AV on Windows server 2016 or 2019 the Windows Defender Antivirus is locked in to active mode regardless of set up.

https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility

The options are to use the registry key to switch it to passive mode

• Path: HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection
• Name: ForceDefenderPassiveMode
• Type: REG_DWORD
• Value: 1

Or uninstall which can be done via PowerShell

• Uninstall-WindowsFeature -Name Windows-Defender
• Uninstall-WindowsFeature -Name Windows-Defender-GUI

https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016#need-to-uninstall-microsoft-defender-antivirus